# MCP runtime audit evidence — 2026-07-30

Audit client: `equitylayer-curation-audit/1.0.0`  
Location: Taipei  
Protocol requested: `2025-03-26`  
Credentials used: none

This appendix preserves the reproducible commands and material response excerpts behind the public verification summary. Ephemeral MCP session IDs and CDN request IDs are redacted.

## Repository source snapshots

Command:

```sh
curl -sS "https://api.github.com/repos/{owner}/{repo}"
curl -sS "https://api.github.com/repos/{owner}/{repo}/commits/{default_branch}"
```

Observed on `2026-07-30T10:58Z`:

| Repository | Default branch revision | Revision time (UTC) | Archived | License reported by GitHub |
| --- | --- | --- | --- | --- |
| [financial-datasets/mcp-server](https://github.com/financial-datasets/mcp-server) | `08e7a3dbb949d3d99bbd6d6f3a22e5f02973ec58` | 2025-06-05T19:50:35Z | false | MIT |
| [stefanoamorelli/sec-edgar-mcp](https://github.com/stefanoamorelli/sec-edgar-mcp) | `c9726addaecec76f8a225f54e77d4ab955f8ddfb` | 2026-05-26T10:40:15Z | false | AGPL-3.0 |
| [alphavantage/alpha_vantage_mcp](https://github.com/alphavantage/alpha_vantage_mcp) | `536aa32e194f8e1483bfde6abdd680ebc161dd84` | 2026-07-26T07:47:01Z | false | MIT |
| [cdtait/fmp-mcp-server](https://github.com/cdtait/fmp-mcp-server) | `0cac7e78c90d7cf158743d42d706181e732cac9a` | 2025-06-23T21:28:59Z | false | MIT |
| [OpenBB-finance/OpenBB](https://github.com/OpenBB-finance/OpenBB) | `3e071fcc2cd9f891cac6040ae60296dba76dab46` | 2026-07-20T17:45:28Z | false | NOASSERTION |
| [massive-com/mcp_massive](https://github.com/massive-com/mcp_massive) | `c58ec7e4df7482c53fc4adeb2de0e979f77f3a23` | 2026-05-05T20:26:20Z | false | MIT |
| [OctagonAI/octagon-mcp-server](https://github.com/OctagonAI/octagon-mcp-server) | `a3234633fbcc523be4b2ed68233c9e967c0c7fa2` | 2026-07-09T19:52:51Z | false | MIT |

OpenBB's license is shown as `NOASSERTION` by the GitHub API; the product's AGPL-3.0 label comes from the repository's own license documentation, not the API field.

## CoinGecko — runtime verified

Official documentation: [CoinGecko MCP Server](https://docs.coingecko.com/ai-integration/mcp-server)  
Endpoint: `https://mcp.api.coingecko.com/mcp`

Initialize command shape:

```sh
curl -i -X POST https://mcp.api.coingecko.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"equitylayer-curation-audit","version":"1.0.0"}}}'
```

Observed at `2026-07-30T10:57:19Z`:

```text
HTTP/2 200
content-type: text/event-stream
serverInfo.name: coingecko_coingecko_typescript_api
serverInfo.version: 7.0.0
protocolVersion: 2025-03-26
```

`tools/list` returned two tools: `execute` and `search_docs`.

Live read command body:

```json
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "execute",
    "arguments": {
      "intent": "Verify a live Bitcoin USD price read for the EquityLayer curation audit",
      "code": "async function run(client) { return await client.simple.price.get({ vs_currencies: 'usd', ids: 'bitcoin', include_last_updated_at: true }); }"
    }
  }
}
```

Observed at `2026-07-30T10:57:44Z`:

```json
{
  "result": {
    "bitcoin": {
      "usd": 64485,
      "last_updated_at": 1785409060
    }
  }
}
```

The returned timestamp converts to `2026-07-30T10:57:40Z`. This is a point-in-time connectivity check, not stored market data or an investment claim.

## Alpha Vantage — endpoint verified

Endpoint: `https://mcp.alphavantage.co/mcp`

The same unauthenticated initialize request returned at `2026-07-30T10:57:56Z`:

```text
HTTP/2 401
www-authenticate: Bearer error="invalid_request", error_description="Missing access token", resource_metadata="https://mcp.alphavantage.co/.well-known/oauth-protected-resource/mcp"
{"error":"invalid_request","error_description":"Missing access token"}
```

This proves the official OAuth-protected endpoint is reachable; it does not prove a credentialed market-data call.

## DefiLlama — endpoint verified

Official product page: [DefiLlama MCP](https://defillama.com/mcp)  
Endpoint: `https://mcp.defillama.com/mcp`

The same unauthenticated initialize request returned at `2026-07-30T10:57:58Z`:

```text
HTTP/2 401
www-authenticate: Bearer error="invalid_token", error_description="Missing Authorization header", resource_metadata="https://mcp.defillama.com/.well-known/oauth-protected-resource/mcp"
{"error":"invalid_token","error_description":"Missing Authorization header"}
```

This proves the OAuth-protected endpoint is reachable; it does not prove a paid authenticated data call.

## SEC EDGAR — runtime failed

Command:

```sh
uvx --from sec-edgar-mcp sec-edgar-mcp
```

Observed at `2026-07-30T10:58Z` with `sec-edgar-mcp==1.0.8` and `mcp==2.0.0`:

```text
File ".../site-packages/sec_edgar_mcp/server.py", line 3, in <module>
  from mcp.server.fastmcp import FastMCP
ModuleNotFoundError: No module named 'mcp.server.fastmcp'
```

Docker fallback check:

```text
Cannot connect to the Docker daemon at unix://<redacted-home>/.docker/run/docker.sock.
```

The curator's home directory is redacted as `<redacted-home>`; nothing else in the line is altered, and the socket path relative to the home directory is reproducible on any machine.

The recommended Docker runtime therefore remains untested. The public page deliberately says `Runtime failed`.